CVE-2020-2093: CSRF vulnerability in Health Advisor by CloudBees Plugin
Summary
CVE-2020-2093: CSRF vulnerability in Health Advisor by CloudBees Plugin. Affects org.jenkins-ci.plugins:cloudbees-jenkins-advisor versions < 3.0.1. Fixed in 3.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Health Advisor by CloudBees Plugin is a Maven package that provides health advisory functionality for Jenkins, an open-source automation server. This plugin allows users to monitor the health of their Jenkins instance and receive recommendations for improving its performance and stability. It is widely used by Jenkins administrators to ensure the smooth operation of their CI/CD pipelines.
Vulnerability Detail
The Health Advisor by CloudBees Plugin version 3.0 and earlier is vulnerable to a CSRF (Cross-Site Request Forgery) attack. The plugin does not perform permission checks in methods that perform form validation, allowing users with Overall/Read access to send an email with fixed content to an attacker-specified recipient. Additionally, these form validation methods do not require POST requests, further exposing the plugin to CSRF attacks. This vulnerability can be exploited by an authenticated attacker to send malicious emails or perform unauthorized actions on behalf of other users.
How To Fix
Latest published version: 412.v9d1e9d6a_f428 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to upgrade to the latest version of the Health Advisor by CloudBees Plugin to address the issue.
Conclusion
The CSRF vulnerability in Health Advisor by CloudBees Plugin can allow attackers to send malicious emails or perform unauthorized actions. To mitigate this risk, it is crucial to upgrade to version 3.0.1 or later of the plugin. Jenkins administrators should prioritize the update to ensure the security and integrity of their Jenkins instance. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:cloudbees-jenkins-advisor →
FAQ
This vulnerability allows an attacker with Overall/Read access to send malicious emails or perform unauthorized actions on behalf of other users. It can lead to the compromise of sensitive information or the disruption of Jenkins workflows.
Users of Health Advisor by CloudBees Plugin versions 3.0 and earlier are affected by this vulnerability. Jenkins administrators should ensure they are running the latest version of the plugin to mitigate the risk.
There are no known public exploits for this vulnerability at the time of this advisory. However, it is important to promptly update the plugin to protect against potential attacks.
No, this vulnerability can only be exploited by authenticated users with Overall/Read access to the Jenkins instance.
Yes, the CVSS score for this vulnerability is 5.0 (Medium).
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:cloudbees-jenkins-advisor.
